5.5
MEDIUM CVSS 3.1
CVE-2026-53306
tty: hvc_iucv: fix off-by-one in number of supported devices
Description

In the Linux kernel, the following vulnerability has been resolved: tty: hvc_iucv: fix off-by-one in number of supported devices MAX_HVC_IUCV_LINES == HVC_ALLOC_TTY_ADAPTERS == 8. This is the number of entries in: static struct hvc_iucv_private *hvc_iucv_table[MAX_HVC_IUCV_LINES]; Sometimes hvc_iucv_table[] is limited by: (a) if (num > hvc_iucv_devices) // for error detection or (b) for (i = 0; i < hvc_iucv_devices; i++) // in 2 places (so these 2 don't agree; second one appears to be correct to me.) hvc_iucv_devices can be 0..8. This is a counter. (c) if (hvc_iucv_devices > MAX_HVC_IUCV_LINES) If hvc_iucv_devices == 8, (a) allows the code to access hvc_iucv_table[8]. Oops.

INFO

Published Date :

June 26, 2026, 8:17 p.m.

Last Modified :

July 6, 2026, 8:14 p.m.

Remotely Exploit :

No

Source :

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Affected Products

The following products are affected by CVE-2026-53306 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Linux linux_kernel
CVSS Scores
The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.
Score Version Severity Vector Exploitability Score Impact Score Source
CVSS 3.1 MEDIUM [email protected]
Solution
Update the Linux kernel to fix an off-by-one error in device support handling.
  • Update the Linux kernel to the latest version.
  • Apply the provided patch for hvc_iucv.
  • Verify the device support count logic.
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-53306 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-53306 weaknesses.

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2026-53306 vulnerability anywhere in the article.

The following table lists the changes that have been made to the CVE-2026-53306 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • Initial Analysis by [email protected]

    Jul. 06, 2026

    Action Type Old Value New Value
    Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
    Added CWE CWE-193
    Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.141 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.12.91 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.13 up to (excluding) 6.18.33 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.19 up to (excluding) 7.0.10 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 6.1.175 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 5.15.209 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 2.6.29 up to (excluding) 5.10.258
    Added Reference Type kernel.org: https://git.kernel.org/stable/c/11207e42a332eb8bbcb9fe74df9edd2a807c5607 Types: Patch
    Added Reference Type kernel.org: https://git.kernel.org/stable/c/3104a3f40feb107f77d7116ad9bf6c210ab7babf Types: Patch
    Added Reference Type kernel.org: https://git.kernel.org/stable/c/3d3b89e6ab93bdd0efd45828bda6b0e61cc46dff Types: Patch
    Added Reference Type kernel.org: https://git.kernel.org/stable/c/484357dff256c816d9466bda35eb765685e4dc86 Types: Patch
    Added Reference Type kernel.org: https://git.kernel.org/stable/c/a76511bc654819425d3b15e77b523d7f9d81f064 Types: Patch
    Added Reference Type kernel.org: https://git.kernel.org/stable/c/f1dc8e72de9aabe5d96767a4e97219ac26b79fe5 Types: Patch
    Added Reference Type kernel.org: https://git.kernel.org/stable/c/f2a880e802ad12d1e38039d1334fb1475d0f5241 Types: Patch
    Added Reference Type kernel.org: https://git.kernel.org/stable/c/fed8b8f33a46db0ee2efdb000f4f630c86ed8ca4 Types: Patch
  • New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Jun. 26, 2026

    Action Type Old Value New Value
    Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '44a01d5ba8a4d543694461cd3e178cfa6b3f221b', 'lessThan': '3d3b89e6ab93bdd0efd45828bda6b0e61cc46dff', 'versionType': 'git'}, {'status': 'affected', 'version': '44a01d5ba8a4d543694461cd3e178cfa6b3f221b', 'lessThan': '484357dff256c816d9466bda35eb765685e4dc86', 'versionType': 'git'}, {'status': 'affected', 'version': '44a01d5ba8a4d543694461cd3e178cfa6b3f221b', 'lessThan': '11207e42a332eb8bbcb9fe74df9edd2a807c5607', 'versionType': 'git'}, {'status': 'affected', 'version': '44a01d5ba8a4d543694461cd3e178cfa6b3f221b', 'lessThan': 'fed8b8f33a46db0ee2efdb000f4f630c86ed8ca4', 'versionType': 'git'}, {'status': 'affected', 'version': '44a01d5ba8a4d543694461cd3e178cfa6b3f221b', 'lessThan': 'a76511bc654819425d3b15e77b523d7f9d81f064', 'versionType': 'git'}, {'status': 'affected', 'version': '44a01d5ba8a4d543694461cd3e178cfa6b3f221b', 'lessThan': '3104a3f40feb107f77d7116ad9bf6c210ab7babf', 'versionType': 'git'}, {'status': 'affected', 'version': '44a01d5ba8a4d543694461cd3e178cfa6b3f221b', 'lessThan': 'f1dc8e72de9aabe5d96767a4e97219ac26b79fe5', 'versionType': 'git'}, {'status': 'affected', 'version': '44a01d5ba8a4d543694461cd3e178cfa6b3f221b', 'lessThan': 'f2a880e802ad12d1e38039d1334fb1475d0f5241', 'versionType': 'git'}], 'programFiles': ['drivers/tty/hvc/hvc_iucv.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '2.6.29'}, {'status': 'unaffected', 'version': '0', 'lessThan': '2.6.29', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.258', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.209', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.175', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.141', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.91', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.33', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.10', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/tty/hvc/hvc_iucv.c'], 'defaultStatus': 'affected'}]
    Added Description In the Linux kernel, the following vulnerability has been resolved: tty: hvc_iucv: fix off-by-one in number of supported devices MAX_HVC_IUCV_LINES == HVC_ALLOC_TTY_ADAPTERS == 8. This is the number of entries in: static struct hvc_iucv_private *hvc_iucv_table[MAX_HVC_IUCV_LINES]; Sometimes hvc_iucv_table[] is limited by: (a) if (num > hvc_iucv_devices) // for error detection or (b) for (i = 0; i < hvc_iucv_devices; i++) // in 2 places (so these 2 don't agree; second one appears to be correct to me.) hvc_iucv_devices can be 0..8. This is a counter. (c) if (hvc_iucv_devices > MAX_HVC_IUCV_LINES) If hvc_iucv_devices == 8, (a) allows the code to access hvc_iucv_table[8]. Oops.
    Added Reference https://git.kernel.org/stable/c/11207e42a332eb8bbcb9fe74df9edd2a807c5607
    Added Reference https://git.kernel.org/stable/c/3104a3f40feb107f77d7116ad9bf6c210ab7babf
    Added Reference https://git.kernel.org/stable/c/3d3b89e6ab93bdd0efd45828bda6b0e61cc46dff
    Added Reference https://git.kernel.org/stable/c/484357dff256c816d9466bda35eb765685e4dc86
    Added Reference https://git.kernel.org/stable/c/a76511bc654819425d3b15e77b523d7f9d81f064
    Added Reference https://git.kernel.org/stable/c/f1dc8e72de9aabe5d96767a4e97219ac26b79fe5
    Added Reference https://git.kernel.org/stable/c/f2a880e802ad12d1e38039d1334fb1475d0f5241
    Added Reference https://git.kernel.org/stable/c/fed8b8f33a46db0ee2efdb000f4f630c86ed8ca4
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.